CVE-2020-7957: Dovecot

Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days.

The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages.

Affected products

• Dovecot Dovecot: from 2.3.9, before 2.3.9.3 (fixed in 2.3.9.3)
• Fedoraproject Fedora: version 30 only; version 31 only

Published 2020-02-12. Last modified 2026-06-17.